CVE-2018-14730: Missing Origin Validation in browserify-hmr
Summary
CVE-2018-14730: Missing Origin Validation in browserify-hmr. Affects browserify-hmr versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The browserify-hmr package is a tool used for Hot Module Replacement (HMR) in the browserify ecosystem. HMR allows developers to update modules in real-time without requiring a full page reload. It enhances the development experience by providing faster feedback and reducing the need for manual refreshes. However, versions prior to 0.4.0 of browserify-hmr are vulnerable to a missing origin validation issue on the websocket server.
Vulnerability Detail
The missing origin validation vulnerability in browserify-hmr allows a remote attacker to steal a developer's source code. This occurs because the origin of requests to the websocket server used for HMR is not properly validated. By exploiting this vulnerability, an attacker can send malicious requests to the websocket server and gain unauthorized access to the developer's source code. This can lead to the exposure of sensitive information and potential misuse of the source code.
How To Fix
Latest published version: 0.4.1 as of 22 Oct 2026
npm install browserify-hmr@0.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
npm install browserify-hmr@0.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The missing origin validation vulnerability in browserify-hmr can lead to the theft of a developer's source code. To mitigate this risk, it is crucial to upgrade to version 0.4.0 or later of the package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for browserify-hmr →
FAQ
browserify-hmr is a package used for Hot Module Replacement (HMR) in the browserify ecosystem. It enables developers to update modules in real-time without requiring a full page reload.
The vulnerability allows remote attackers to steal a developer's source code. This can lead to the exposure of sensitive information and potential misuse of the source code.
To fix this vulnerability, upgrade to version 0.4.0 or later of browserify-hmr.
No specific workarounds have been provided for this vulnerability. It is recommended to upgrade to the fixed version.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-77q4-m83q-w76v/GHSA-77q4-m83q-w76v.json
